New SOHO Router Botnet AVrecon Spreads to 70,000 Devices Across 20 Countries

Jul 14, 2023THNNetwork Security / Malware

A new malware strain has been found covertly targeting small office/home office (SOHO) routers for more than two years, infiltrating over 70,000 devices and creating a botnet with 40,000 nodes spanning 20 countries.

Lumen Black Lotus Labs has dubbed the malware AVrecon, making it the third such strain to focus on SOHO routers after ZuoRAT and HiatusRAT over the past year.

“This makes AVrecon one of the largest SOHO router-targeting botnets ever seen,” the company said. “The purpose of the campaign appears to be the creation of a covert network to quietly enable a range of criminal activities from password spraying to digital advertising fraud.”

A majority of the infections are located in the U.K. and the U.S., followed by Argentina, Nigeria, Brazil, Italy, Bangladesh, Vietnam, India, Russia, and South Africa, among others.

AVrecon was first highlighted by Kaspersky senior security researcher Ye (Seth) Jin in May 2021, indicating that the malware has managed to avoid detection until now.

In the attack chain detailed by Lumen, a successful infection is followed by enumerating the victim’s SOHO router and exfiltrating that information back to an embedded command-and-control (C2) server.

It also checks if other instances of malware are already running on the host by searching for existing processes on port 48102 and opening a listener on that port. A process bound to that port is terminated.

The next stage involves the compromised system establishing contact with a separate server, called the secondary C2 server, to await further commands. Lumen said it identified 15 such unique servers that have been active since at least October 2021.

It’s worth noting that tiered C2 infrastructure is prevalent among notorious botnets like Emotet and QakBot.

AVrecon is written in the C programming language, making it easy to port the malware for different architectures. What’s more, a crucial reason why such attacks work is because they leverage infrastructure living on the edge that typically lacks support for security solutions.

Evidence gathered so far points to the botnet being used for clicking on various Facebook and Google ads, and to interact with Microsoft Outlook. This likely indicates a two-pronged effort to conduct advertising fraud and data exfiltration.

“The manner of attack seems to focus predominantly on stealing bandwidth – without impacting end-users – in order to create a residential proxy service to help launder malicious activity and avoid attracting the same level of attention from Tor-hidden services or commercially available VPN services,” the researchers said.